Safe data acquisition gateway based on DPDK network card isolation and efficient balanced communication method

Abstract

The invention discloses a security data acquisition gateway based on DPDK network card isolation, which adopts DPDK network card TCP / IP communication to realize isolation of a sending end and a receiving end, and finally realizes an efficient balanced communication function of the sending end and the receiving end. According to the invention, the isolation of the sending end and the receiving end is realized based on the TCP / IP communication of the DPDK network card, the specific data packet is analyzed and forwarded through the inherent function of the DPDK network card, the anti-interference and anti-virus capabilities are strong, and the security of the system is significantly improved; and compared with a security gateway based on USB isolation, the security gateway has higher transmission speed.

Description

Technical Field

[0001] This invention relates to the field of communications, specifically to a secure data acquisition gateway based on DPDK network card isolation and an efficient and balanced communication method. Background Technology

[0002] The development of industrialization and informatization has led to the close integration of traditional computer networks and industrial control networks. More and more enterprise management information systems, such as Production Execution Systems (MES) in typical process industries like petroleum and chemical engineering, utilize various data interaction devices to collect real-time data from control systems, thereby achieving optimized control. In particular, the gradual deepening application of new technologies such as the Internet of Things and big data has made the connection between management networks and industrial control networks increasingly close, expanding the access scope of industrial control networks, but also increasing security risks.

[0003] To collect production data from the control system into the MES, existing data acquisition gateways generally use Windows or Linux operating systems and employ TCP / IP communication technology, similar to industrial control networks or management networks, to communicate with the control system or MES system. Viruses can exploit operating system vulnerabilities or TCP / IP communication vulnerabilities to attack the control network or MES system. When some gateways use USB interfaces for communication, the communication speed is low and full-duplex communication is not supported. Summary of the Invention

[0004] To address the aforementioned issues, this invention discloses a secure data acquisition gateway based on DPDK network interface card (NIC) isolation. It employs DPDK NIC TCP / IP communication to achieve isolation between the sending and receiving ends, ultimately realizing efficient and balanced communication between the sending and receiving ends.

[0005] Technical solution:

[0006] This invention first discloses a secure data acquisition gateway based on DPDK network card isolation.

[0007] The secure data acquisition gateway includes an upper-level motherboard, an isolation unit, and a lower-level motherboard. The isolation unit includes two DPDK network cards, each connected to one end of the upper-level motherboard and the other end of the lower-level motherboard via a PCIe interface. The other end of the lower-level motherboard communicates bidirectionally with m terminals of the control system via TCP / IP, and the other end of the upper-level motherboard communicates bidirectionally with n terminals of the MES system via TCP / IP. Here, m and n are natural numbers determined based on the actual industrial environment.

[0008] The secure data acquisition gateway communication system includes: m data acquisition program modules, 1 scheduling management program module, and a lower-level data service program module running on the lower-level motherboard; n data acquisition program modules, 1 scheduling management program module, and an upper-level data service program module running on the upper-level motherboard; m terminals of the control system and n terminals of the MES system are all denoted as terminal nodes of the gateway communication system; the upper-level motherboard and the lower-level motherboard are configured with m corresponding lower-level machines and n corresponding upper-level machines as gateway communication relay nodes;

[0009] Each terminal node establishes a TCP communication link with its corresponding relay node to send and receive data. The data service program module receives and caches data from all local terminal nodes, packages it, isolates it through the DPDK network card, and sends it to the data service of the relay node on the other side. At the same time, the data service program module receives data packets from the relay node on the other side and distributes them to the target terminal node.

[0010] A pair of terminals based on TCP / IP communication consists of a server and a client. The server opens a listening port, and the client connects to that port to establish a communication link. After an isolation card is added, the two terminals cannot directly establish a connection and need to communicate through the port mapping function of the data service of the relay node. For example, a terminal running on the upper motherboard opens port 80 for listening, and the data service also opens port 80 on the lower motherboard (which can be configured to other port numbers). The client on the lower motherboard connects to the local port 80, and the data service forwards the data to the upper computer's port 80. The data service communication between the upper and lower motherboards uses a proprietary protocol, supporting concurrent full-duplex communication from multiple terminals.

[0011] Each terminal node establishes a communication link with its corresponding relay node to send and receive data. Different terminal nodes are distinguished within the relay node by port numbers 1 to 65535.

[0012] Preferably, the two DPDK network cards are connected via an Ethernet cable, and the DPDK network card model is Intel i40e network card.

[0013] Preferably, the lower-level motherboard uses a common x86 or ARM-based computer motherboard, and the motherboard's TCP / IP interface is connected to an external control system.

[0014] Preferably, the host motherboard uses a common x86 or ARM-based computer motherboard, and the motherboard's TCP / IP interface is connected to an external MES system.

[0015] Preferably, the models of the upper and lower motherboards are Beijing Leyan RIS-6840.

[0016] This invention also discloses an efficient balanced communication method for a secure data acquisition gateway based on DPDK network card isolation. The network card directly exchanges data with the user-space driver, bypassing the system protocol kernel stack. Polling is used instead of interrupts to reduce context overhead, and memory management is based on Mempool technology. The efficient communication steps of the secure data acquisition gateway based on DPDK network card isolation include connection establishment, data transmission, and connection release. The Mempool uses a central queue ring structure to store mbufs; one packet is stored in one mbuf, and a group of mbufs is stored in one ring. In this structure, mbuf is the basic unit for managing data packets. The Mempool memory pool uses fixed-size mbuf as its basic unit, allocating a large block of memory at a time, thus avoiding the runtime allocation overhead of the traditional mallocfree system call. The specific dynamic management process is as follows: Based on preset initialization parameters, memory pools for receiving and sending are created and bound to the receive / send queues. During data reception, the utilization rate of the current receiving memory pool M1 is monitored in real time. When the utilization rate exceeds a set threshold and the current size of memory pool M1 has not reached the set upper limit, the memory pool expansion logic is triggered: a new memory pool M2 is created, twice the size of M1; port reception is stopped, memory pool M2 is rebound to the rx queue, and then port reception is restarted; unprocessed data in memory pool M1 is temporarily stored; in subsequent packet reception processes, residual data in memory pool M1 is processed first, and after processing, it is released, and memory pool M2 becomes the current memory pool M1.

[0017] Preferably, the connection establishment step specifically includes:

[0018] 1) A secure data acquisition gateway based on DPDK network card isolation with efficient and balanced communication terminal message format, the terminal TCP connection to the local data service mapping port, the data service obtains the terminal's IP address, determines whether it is in the whitelist, and can only access the communication system after verification;

[0019] The message format includes two main parts: a message header and a message payload, with the message payload immediately following the message header.

[0020] The message header has a fixed length of 8 bytes, where: Start identifier: the first byte of the message header, used to locate the position of the message header, with a fixed value of 0xfd;

[0021] The second byte of the message header, consisting of 8 bits, specifies the message behavior. The high 4 bits are reserved, and the low 4 bits, from low to high, represent CON, ACK, FIN, and RST, each occupying 1 bit. CON: Connection flag, set to 1 when requesting or replying to a connection; ACK: Acknowledgment flag, set to 1 when both CON and ACK are present to indicate a successful connection, informing the sender that the connection request has been received and is ready to receive data; FIN: End flag, set to 1 to inform the receiver that the sender has finished sending data and can close the connection; RST: Reset flag, set to 1 to inform the receiver that the connection is invalid and to release resources.

[0022] The third and fourth bytes of the message header represent the data packet length, which indicates the length of the message payload, i.e., the transmitted data in bytes; it is two bytes long.

[0023] The fifth and sixth bytes of the message header are the source port number, which is a unique identifier of the message sender and consists of two bytes.

[0024] The first seven and eight bytes of the message are the destination port number, representing a unique identifier for the message receiver; these bytes are two.

[0025] 2) The data service creates a new message, generates a local unique identifier, writes the source port number in the header; the destination port number is the listening port number of the remote terminal, con is set to 1, and it is sent to the remote data service.

[0026] 3) The remote data service receives the message, parses the source port number and destination port number in the header; the destination port number of the returned message is the source port number of the message received in step 2; if successful, the source port number in the header is the local relay node identifier, con is set to 1, and ack is set to 1; if unsuccessful, the source port number in the header is the destination port number of the message received in step 2, con is set to 1, and rst is set to 1.

[0027] Preferably, the data transmission steps are as follows:

[0028] 1) The terminal sends data to different relay nodes, and the relay nodes write the data into the corresponding memory buffer;

[0029] 2) The data service module calls the adaptive scheduling algorithm in the scheduling management program module to calculate and select relay nodes, with high-weight nodes being selected first over low-weight nodes; the data service reads data from the memory buffer of the selected node, packages it, and sends it to the peer data service; the selected node re-enters the queue.

[0030] 3) After receiving the message, the peer data service parses the message header, locates the target node, and writes the data into the target node's memory buffer;

[0031] 4) The target node reads data from the memory buffer and sends it to the target terminal. Preferably, its connection release characteristics are as follows:

[0032] There are two scenarios for the end of the relay node's lifecycle: normal release and abnormal handling release.

[0033] Once a relay node has been marked as having completed forwarding and sending, its lifecycle ends normally, and the relay node resources are released.

[0034] When the connection between the relay node and the terminal is abnormally interrupted, the data service immediately releases the relay node and sends a message to the remote data service with the rst header set to 1. After receiving the message, the remote data service releases the corresponding forwarding node.

[0035] Preferably, its adaptive scheduling algorithm generates the polling order, and the specific steps are as follows:

[0036] (1) Relay nodes 1, 2, ..., J are configured with different weights a1, a2, ..., a according to the priority of the business. J J is an integer less than or equal to m and n, corresponding to the different priorities of J relay nodes, where the configuration priority a for any node j is... j It is an integer less than or equal to J, and the larger the value, the higher the priority; the memory buffer occupancy rate of each corresponding relay node is recorded as: b1, b2, ..., b J ;

[0037] (2) Set Y j Y represents the priority of the j-th relay node, where j is a positive number less than or equal to J. j Let m1 be the priority of the j-th intermediate node. j Let m2 (Y) be the probability allocation result of j intermediate nodes based on the assigned weights. j The result of the basic probability allocation of j intermediate nodes based on memory buffer occupancy weights is as follows:

[0038] m1 (Y j )=a j / (a1+a2+...+a J )

[0039] m2 (Y j )=b j / (b1+b2+...+b J )

[0040] (3) Calculate the weight probability assignment of the j-th intermediate node after fusion. :

[0041]

[0042]

[0043] X1 represents one of the J cases corresponding to priorities 1, 2, ... J in the configuration weights, and m1(X1) is the weight allocation based on Y. j The basic probability assignment values ​​for each case; X2 represents one of the J cases corresponding to priorities 1, 2, ... J in the image classification algorithm, and m2(X2) is the probability distribution of Y based on memory buffer occupancy. j The basic probability distribution of the situation.

[0044] Beneficial effects of the present invention

[0045] 1) The DPDK network card TCP / IP communication achieves isolation between the sending and receiving ends. By using the inherent functions of the DPDK network card to parse and forward specific data packets, it has strong anti-interference and anti-virus capabilities, significantly improving the security of the invention; moreover, it has a faster transmission speed than a security gateway based on USB isolation.

[0046] 2) DPDK uses a user-space driver, allowing the network card to exchange data directly with the user-space driver, bypassing the...

[0047] The kernel protocol stack avoids interruptions and copying during data exchange between kernel mode and user mode, reducing overhead. User-mode drivers use a polling mode. The polling mode is far more efficient than the interrupt mode, reducing the overhead of interrupt mode context switching.

[0048] 3) To address the issue of inconsistent data transmission and reception rates, a data memory buffer mechanism was designed. As an intermediate layer for data transmission and reception, the memory buffer can temporarily store data packets to be sent or received, effectively balancing the speed difference between the sender and receiver. In high-throughput or bursty traffic scenarios, the buffer mechanism can smoothly process the data stream, preventing data loss or system performance degradation due to rate mismatch.

[0049] 4) By pre-allocating a fixed-size memory space as a buffer, frequent memory allocation and deallocation operations are avoided, significantly improving system performance and stability. Furthermore, the memory buffer design supports dynamic resizing to adapt to different network environments and business needs, further optimizing resource utilization and system response speed. Through this mechanism, the system can maintain efficient and stable data transmission capabilities under complex network conditions.

[0050] 5) The polling mode dynamically determines the polling order. When polling starts, the polling order is dynamically determined based on the adaptive scheduling algorithm. The adaptive scheduling algorithm integrates the preset weight data of different intermediate nodes and the actual memory buffer occupancy information. It can not only differentiate based on the importance of the data, but also fully consider the load status of the intermediate nodes. Attached Figure Description

[0051] Figure 1This is a schematic diagram of a secure data acquisition gateway framework based on DPDK network card isolation according to the present invention.

[0052] Figure 2 This is a diagram illustrating the efficient and balanced communication data flow of a secure data acquisition gateway based on DPDK network card isolation, as described in this invention.

[0053] Figure 3 This is a diagram illustrating the message format of a high-efficiency balanced communication terminal in a secure data acquisition gateway based on DPDK network card isolation according to the present invention.

[0054] Figure 4 This is a flowchart illustrating the efficient and balanced communication connection establishment process of a secure data acquisition gateway based on DPDK network card isolation according to the present invention.

[0055] Figure 5 This is a flowchart illustrating the efficient and balanced data transmission process between communication relay nodes of a secure data acquisition gateway based on DPDK network card isolation according to the present invention.

[0056] Figure 6 This is a flowchart illustrating the efficient and balanced data reception process between communication relay nodes of a secure data acquisition gateway based on DPDK network card isolation according to the present invention.

[0057] Figure 7 This is a flowchart illustrating the efficient and balanced data transmission process between communication relay nodes to the terminal using a DPDK network card isolation-based secure data acquisition gateway according to the present invention.

[0058] Figure 8 This is a flowchart illustrating the process of releasing connection to a receiving terminal in a secure data acquisition gateway based on DPDK network card isolation according to the present invention. Detailed Implementation

[0059] The present invention will be further described below with reference to embodiments, but the scope of protection of the present invention is not limited thereto:

[0060] like Figure 1 As shown, a secure data acquisition gateway and efficient balanced communication method based on DPDK network card isolation are disclosed, including an upper motherboard, an isolation card, and a lower motherboard. The lower motherboard communicates bidirectionally with m terminals of the control system via TCP / IP, and the upper motherboard communicates bidirectionally with n terminals of the MES system via TCP / IP. m and n are natural numbers determined according to the actual industrial environment.

[0061] The isolation card is connected to the upper and lower motherboards via a DPDK network card. The lower motherboard uses a common x86 or ARM-based computer motherboard. The isolation card is read and written by calling DPDK functions through the DPDK network card, and its TCP / IP is connected to the external DCS system.

[0062] The host motherboard uses a common x86 or ARM-based computer motherboard, and uses DPDK functions to read and write to the isolation card. Its TCP / IP is connected to the external MES system.

[0063] The preferred motherboards for the upper and lower levels are the Sinbu Technology SV1-F2026C. The isolation unit consists of two DPDK network cards connected via an Ethernet cable. The preferred DPDK network card model is the Intel i40e network card.

[0064] like Figure 2 This paper presents a high-efficiency, balanced communication data flow diagram for a secure data acquisition gateway based on DPDK network interface card (NIC) isolation, and outlines a method for achieving this. The secure data acquisition gateway communication system includes: m data acquisition program modules, one scheduling and management program module, and a lower-level data service program module running on the lower-level motherboard; and n data acquisition program modules, one scheduling and management program module, and an upper-level data service program module running on the upper-level motherboard. The m terminals of the control system and the n terminals of the MES system are denoted as terminal nodes of the gateway communication system. The upper-level and lower-level motherboards are configured with corresponding m lower-level machines and n corresponding upper-level gateway communication relay nodes.

[0065] For both the host and slave devices, the network interface card (NIC) directly exchanges data with the user-space driver. Memory management is based on Mempool technology, bypassing the kernel protocol stack and avoiding interruptions and copying during data exchange between kernel and user space, thus reducing overhead. Mempool uses a ring structure to store mbufs; one packet is stored in one mbuf, and a group of mbufs is stored in a ring structure.

[0066] The internal dynamic management process is as follows:

[0067] Based on the preset initialization parameters, create memory pools for receiving and sending, and bind the memory pools to the send and receive queues;

[0068] During data reception, the utilization rate of the current receiving memory pool M1 is monitored in real time. When the utilization rate exceeds a set threshold (e.g., 90%) and the current size of memory pool M1 has not reached the set upper limit, the memory pool expansion logic is triggered: a new memory pool M2 is created, with a size twice that of M1. Port reception is stopped, memory pool M2 is rebound to the rx queue, and then port reception is restarted. Unprocessed data in memory pool M1 is temporarily stored. In subsequent packet reception, residual data in memory pool M1 is processed first, and released after data processing. Memory pool M2 is then used as the current memory pool M1.

[0069] The key code for implementing memory management is as follows:

[0070] 1. Initialization and Global Variable Definition

[0071] #define MEMPOOL_INIT_SIZE 64 * 1024 * 1024

[0072] #define NUM_MBUFS MEMPOOL_INIT_SIZE / (sizeof(struct rte_mbuf) + RTE_MBUF_DEFAULT_DATAROOM)

[0073] / / Maximum size of memory pool

[0074] #define MAX_MEMPOOL_SIZE (MEMPOOL_INIT_SIZE * 4)

[0075] / / Maximum memory usage

[0076] #define MAX_MEMPOOL_USED_RATE 90

[0077] / / Currently using memory pool

[0078] static struct rte_mempool *mbuf_pool = NULL;

[0079] / / Old memory pool after expansion

[0080] static struct rte_mempool *old_mbuf_pool = NULL;

[0081] 2. Memory pool utilization detection

[0082] unsigned free = rte_mempool_avail_count(mbuf_pool);

[0083] unsigned used = current_mbuf_count - free;

[0084] unsigned usage_percent = used * 100 / current_mbuf_count;

[0085] / / Expand memory when the memory pool exceeds the maximum utilization (default 90%) but does not exceed the maximum memory limit.

[0086] if (usage_percent >= MAX_MEMPOOL_USED_RATE && current_mbuf_count <MAX_MEMPOOL_SIZE) {

[0087] / / Memory expansion

[0088] expand_rx_mempool();

[0089] }

[0090] 3. Dynamically expand memory

[0091] / / Request a new memory pool

[0092] struct rte_mempool *new_pool = rte_pktmbuf_pool_create(

[0093] pool_name,

[0094] current_mbuf_count * 2, MBUF_CACHE_SIZE, 0,

[0095] RTE_MBUF_DEFAULT_BUF_SIZE,

[0096] rte_socket_id() );

[0098] / / Network card bound to memory pool after expansion

[0099] rte_eth_dev_stop(port_id);

[0100] rte_eth_rx_queue_setup(port_id, 0, nb_rxd,

[0101] rte_eth_dev_socket_id(port_id), &rxq_conf, new_pool);

[0102] rte_eth_dev_start(port_id);

[0103] 4. Release old memory pool space

[0104] if (old_mbuf_pool) {

[0105] for(int i=0; i <oldBufCount; i++) {

[0106] / / Submit unprocessed messages from the old memory pool to the application

[0107] handle_remain_data();

[0108] }

[0109] / / Release the old memory pool

[0110] rte_mempool_free(old_mbuf_pool);

[0111] old_mbuf_pool = NULL;

[0112] }

[0113] Each terminal node establishes a TCP communication link with its corresponding relay node for data transmission and reception. The data service module receives and buffers data from all local terminal nodes, packages it, isolates it via the DPDK network card, and then sends it to the data service of the relay node on the other side. Simultaneously, the data service module receives data packets from the relay node on the other side and distributes them to the target terminal node.

[0114] A pair of terminals based on TCP / IP communication consists of a server and a client. The server opens a listening port, and the client connects to that port to establish a communication link. After an isolation card is added, the two terminals cannot directly establish a connection and need to communicate through the port mapping function of the data service of the relay node. For example, a terminal running on the upper motherboard opens port 80 for listening, and the data service also opens port 80 on the lower motherboard (which can be configured to other port numbers). The client on the lower motherboard connects to the local port 80, and the data service forwards the data to the upper computer's port 80. The data service communication between the upper and lower motherboards uses a proprietary protocol, supporting concurrent full-duplex communication from multiple terminals.

[0115] Each terminal node establishes a communication link with its corresponding relay node to send and receive data. Different terminal nodes are distinguished within the relay node by port numbers 1 to 65535.

[0116] The efficient communication steps of a DPDK-based secure data acquisition gateway with NIC isolation include connection establishment, data transmission, and connection release.

[0117] A. Establishing a connection, such as Figure 4 As shown

[0118] 1) For example Figure 3The diagram illustrates a secure data acquisition gateway based on DPDK network card isolation that efficiently balances the communication terminal message format. The terminal's TCP connection maps to the local data service (relay node) port. The data service obtains the terminal's IP address, determines whether it is on the whitelist, and only allows access to the communication system after successful verification.

[0119] 2) The data service creates a new message, generates a local unique identifier, and writes the source port number into the message header. The destination port number is the listening port number of the remote terminal, and the 'con' value is set to 1. The message is then sent to the remote data service.

[0120] 3) The remote data service receives the message, parses the source port number and destination port number in the header, and then the process is detailed in Figure 4 (responder). The destination port number of the returned message is the source port number of the message received in step 2. If successful, the source port number in the header is the local relay node identifier, con is set to 1, and ack is set to 1; if unsuccessful, the source port number in the header is the destination port number of the message received in step 2, con is set to 1, and rst is set to 1.

[0121] 4) The data service receives the returned message and performs subsequent processing based on the result. See Figure 4 for details of the initiator.

[0122] B. Data transmission

[0123] After a successful connection, multiple logical data channels are established in the system, consisting of an upper-level motherboard terminal, a lower-level motherboard terminal, an upper-level motherboard data service relay node, and a lower-level motherboard data service relay node. Each relay node has an independent read / write memory buffer. Data transmission is divided into four steps:

[0124] 1) The terminal sends data to different relay nodes, and the relay nodes write the data into the corresponding memory buffer.

[0125] 2) For example Figure 5 This paper illustrates a high-efficiency, balanced data transmission process between communication relay nodes in a secure data acquisition gateway based on DPDK network interface card isolation. The data service module calls the adaptive scheduling algorithm in the scheduling management program module to calculate and select relay nodes, prioritizing high-weight nodes over low-weight nodes. The data service reads data from the selected node's memory buffer, packages it, and sends it to the peer data service. The selected node then re-enters the queue.

[0126] 3) For example Figure 6 The diagram illustrates a high-efficiency, balanced data reception process between communication relay nodes in a secure data acquisition gateway based on DPDK network card isolation. After receiving a message, the peer data service parses the message header, locates the target node, and writes the data into the target node's memory buffer.

[0127] 4) For example Figure 7This paper illustrates a process for efficiently balancing data transmission between communication relay nodes to a terminal in a secure data acquisition gateway based on DPDK network card isolation. The target node reads data from its memory buffer and sends it to the target terminal.

[0128] During data transmission, the adaptive scheduling algorithm generates the polling order:

[0129] (1) Relay nodes 1, 2, ..., J are configured with different weights a1, a2, ..., a according to the priority of the business. J J is an integer less than or equal to m and n, corresponding to the different priorities of J relay nodes, where the configuration priority a for any node j is... j It is an integer less than or equal to J, and the larger the value, the higher the priority; the memory buffer occupancy rate of each corresponding relay node is recorded as: b1, b2, ..., b J

[0130] (2) Set Y j Y represents the priority of the j-th relay node, where j is a positive number less than or equal to J. j Let m1 be the priority of the j-th intermediate node. j Let m2 (Y) be the probability allocation result of j intermediate nodes based on the assigned weights. j The result of the basic probability allocation of j intermediate nodes based on memory buffer occupancy weights is as follows:

[0131] m1 (Y j )=a j / (a1+a2+...+a J )

[0132] m2 (Y j )=b j / (b1+b2+...+b J )

[0133] (3) Calculate the weight probability assignment of the j-th intermediate node after fusion. :

[0134]

[0135]

[0136] X1 represents one of the J cases corresponding to priorities 1, 2, ... J in the configuration weights, and m1(X1) is the weight allocation based on Y. j The basic probability assignment values ​​for each case; X2 represents one of the J cases corresponding to priorities 1, 2, ... J in the image classification algorithm, and m2(X2) is the probability distribution of Y based on memory buffer occupancy. j The basic probability distribution of the situation.

[0137] C. Connection Release

[0138] like Figure 8 The diagram shows a flowchart of the data connection release process for a secure data acquisition gateway based on DPDK network card isolation and a high-efficiency balanced communication relay node receiving terminal. There are two scenarios for the end of the relay node's lifecycle: normal release and abnormal handling release.

[0139] Once a relay node is marked as having finished forwarding (Figure 5) and has finished sending (Figure 7), its lifecycle ends normally, and the relay node resources are released.

[0140] When the connection between the relay node and the terminal is abnormally interrupted, the data service immediately releases the relay node and sends a message to the remote data service with the rst header set to 1. After receiving the message, the remote data service releases the corresponding forwarding node.

[0141] The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

Claims

1. A secure data acquisition gateway based on DPDK network card isolation, characterized in that: The secure data acquisition gateway includes an upper-level motherboard, an isolation unit, and a lower-level motherboard. The isolation unit includes two DPDK network cards, each connected to one end of the upper-level motherboard and the other end of the lower-level motherboard via a PCIe interface. The other end of the lower-level motherboard communicates bidirectionally with m terminals of the control system via TCP / IP, and the other end of the upper-level motherboard communicates bidirectionally with n terminals of the MES system via TCP / IP. Here, m and n are natural numbers determined based on the actual industrial environment. The secure data acquisition gateway communication system includes: m data acquisition program modules, 1 scheduling management program module, and a lower-level data service program module running on the lower-level motherboard; n data acquisition program modules, 1 scheduling management program module, and an upper-level data service program module running on the upper-level motherboard; m terminals of the control system and n terminals of the MES system are all denoted as terminal nodes of the gateway communication system; the upper-level motherboard and the lower-level motherboard are configured with m corresponding lower-level machines and n corresponding upper-level machines as gateway communication relay nodes; Each terminal node establishes a TCP communication link with its corresponding relay node to send and receive data. The data service program module receives and caches data from all local terminal nodes, packages it, isolates it through the DPDK network card, and sends it to the data service of the relay node on the other side. At the same time, the data service program module receives data packets from the relay node on the other side and distributes them to the target terminal node. A pair of terminals based on TCP / IP communication consists of a server and a client. The server opens a listening port, and the client connects to the port to establish a communication link. After the isolation card is added, the two terminals cannot directly establish a connection and need to communicate through the port mapping function of the relay node data service. Each terminal node establishes a communication link with its corresponding relay node to send and receive data.

2. The secure data acquisition gateway based on DPDK network card isolation according to claim 1, characterized in that... The two DPDK network cards are connected via an Ethernet cable. The DPDK network card model is Intel i40e.

3. A secure data acquisition gateway based on DPDK network card isolation as described in claim 1, characterized in that... The lower-level motherboard uses a common x86 or ARM-based computer motherboard, and the motherboard's TCP / IP interface is connected to the external control system.

4. A secure data acquisition gateway based on DPDK network card isolation as described in claim 1, characterized in that... The host motherboard uses a common x86 or ARM-based computer motherboard, and the motherboard's TCP / IP interface is connected to an external MES system.

5. A secure data acquisition gateway based on DPDK network card isolation as described in claim 1, characterized in that... The model of the upper and lower motherboards is Beijing Leyan RIS-6840.

6. A high-efficiency balanced communication method for a secure data acquisition gateway based on DPDK network card isolation, characterized in that... The network interface card (NIC) directly exchanges data with the user-space driver, bypassing the system protocol kernel stack. It uses polling instead of interrupts to reduce context overhead and manages memory based on Mempool technology. The efficient communication steps of the DPDK-based NIC-isolated secure data acquisition gateway include connection establishment, data transmission, and connection release. The Mempool uses a central queue ring structure to store mbufs. A single packet is stored in one mbuf, and a group of mbufs is stored in a ring structure. The mbuf is the basic unit for managing data packets. The Mempool memory pool uses fixed-size mbufs as its basic unit, allocating a large block of memory at a time, avoiding the runtime allocation overhead of traditional mallocfree system calls. Specifically, the dynamic management process involves: creating memory pools for receiving and sending based on preset initialization parameters and binding them to the receive / send queues; monitoring the utilization rate of the current receiving memory pool M1 in real time during data reception; and triggering memory pool expansion logic when the utilization rate exceeds a set threshold and the current size of memory pool M1 has not reached the set upper limit: creating a new memory pool M2, twice the size of M1. The process involves: stopping port reception, rebinding memory pool M2 to the rx queue, restarting port reception, temporarily storing unprocessed data in memory pool M1, prioritizing the processing of residual data in memory pool M1 during subsequent packet reception, releasing the data after processing, and using memory pool M2 as the current memory pool M1.

7. The efficient balanced communication method for a secure data acquisition gateway based on DPDK network card isolation as described in claim 6, characterized in that... The connection establishment steps are as follows: 1) A secure data acquisition gateway based on DPDK network card isolation with efficient and balanced communication terminal message format, the terminal TCP connection to the local data service mapping port, the data service obtains the terminal's IP address, determines whether it is in the whitelist, and can only access the communication system after verification; The message format includes two main parts: a message header and a message payload, with the message payload immediately following the message header. The message header has a fixed length of 8 bytes, where: Start identifier: the first byte of the message header, used to locate the position of the message header, with a fixed value of 0xfd; The second byte of the message header, consisting of 8 bits, specifies the message behavior. The high 4 bits are reserved, and the low 4 bits, from low to high, represent CON, ACK, FIN, and RST, each occupying 1 bit. CON: Connection flag, set to 1 when requesting or replying to a connection; ACK: Acknowledgment flag, set to 1 when both CON and ACK are present to indicate a successful connection, informing the sender that the connection request has been received and is ready to receive data; FIN: End flag, set to 1 to inform the receiver that the sender has finished sending data and can close the connection; RST: Reset flag, set to 1 to inform the receiver that the connection is invalid and to release resources. The third and fourth bytes of the message header represent the data packet length, which indicates the length of the message payload, i.e., the transmitted data in bytes; it is two bytes long. The fifth and sixth bytes of the message header are the source port number, which is a unique identifier of the message sender and consists of two bytes. The first seven and eight bytes of the message are the destination port number, representing a unique identifier for the message receiver; these bytes are two. 2) The data service creates a new message, generates a local unique identifier, writes the source port number in the header; the destination port number is the listening port number of the remote terminal, con is set to 1, and it is sent to the remote data service. 3) The remote data service receives the message, parses the source port number and destination port number in the header; the destination port number of the returned message is the source port number of the message received in step 2; if successful, the source port number in the header is the local relay node identifier, con is set to 1, and ack is set to 1; if unsuccessful, the source port number in the header is the destination port number of the message received in step 2, con is set to 1, and rst is set to 1.

8. The efficient balanced communication method for a secure data acquisition gateway based on DPDK network card isolation as described in claim 6, characterized in that... The data transmission steps are as follows: 1) The terminal sends data to different relay nodes, and the relay nodes write the data into the corresponding memory buffer; 2) The data service module calls the adaptive scheduling algorithm in the scheduling management program module to calculate and select transit nodes, with high-weight nodes being selected first over low-weight nodes; The data service reads data from the selected node's memory buffer, packages it, and sends it to the peer data service. The selected node re-enters the queue; 3) After receiving the message, the peer data service parses the message header, locates the target node, and writes the data into the target node's memory buffer; 4) The target node reads data from the memory buffer and sends it to the target terminal.

9. The efficient balanced communication method for a secure data acquisition gateway based on DPDK network card isolation as described in claim 6, characterized in that... Its connection release characteristics are as follows: There are two scenarios for the end of the relay node's lifecycle: normal release and abnormal handling release. Once a relay node has been marked as having completed forwarding and sending, its lifecycle ends normally, and the relay node resources are released. When the connection between the relay node and the terminal is abnormally interrupted, the data service immediately releases the relay node and sends a message to the remote data service with the rst header set to 1. After receiving the message, the remote data service releases the corresponding forwarding node.

10. The efficient balanced communication method for a secure data acquisition gateway based on DPDK network card isolation as described in claim 8, characterized in that... Its adaptive scheduling algorithm generates the polling order, and the specific steps are as follows: (1) Relay nodes 1, 2, ..., J are configured with different weights a1, a2, ..., a according to the priority of the business. J J is an integer less than or equal to m and n, corresponding to the different priorities of J relay nodes, where the configuration priority a for any node j is... j It is an integer less than or equal to J, and the larger the value, the higher the priority; the memory buffer occupancy rate of each corresponding relay node is recorded as: b1, b2, ..., b J ; (2) Set Y j Y represents the priority of the j-th relay node, where j is a positive number less than or equal to J. j Let m1 be the priority of the j-th intermediate node. j Let m2 (Y) be the probability allocation result of j intermediate nodes based on the assigned weights. j The result of the basic probability allocation of j intermediate nodes based on memory buffer occupancy weights is as follows: m1 (Y j )=a j / (a1+a2+...+a J ) m2 (Y j )=b j / (b1+b2+...+b J ) (3) Calculate the weight probability assignment of the j-th intermediate node after fusion. : X1 represents one of the J cases corresponding to priorities 1, 2, ... J in the configuration weights, and m1(X1) is the weight allocation based on Y. j The basic probability assignment values ​​for each case; X2 represents one of the J cases corresponding to priorities 1, 2, ... J in the image classification algorithm, and m2(X2) is the probability distribution of Y based on memory buffer occupancy. j The basic probability distribution of the situation.

Images